fa5cd9f1f53351a7121dcfd605bafc54_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fa5cd9f1f53351a7121dcfd605bafc54_JaffaCakes118
Size

264KB
MD5

fa5cd9f1f53351a7121dcfd605bafc54
SHA1

06c0521c9cdebe104469d17172304c9beda858e6
SHA256

6828a6005f3e789fa72ea60dfedfc0079371e93b3db1d3b23a96bcb2fc923414
SHA512

58e365d2b7f9cf61b085762fe7c4397c065438dd0cc991b23a6f805812e4d9e59580850c5f220af091c4a50d4d1cf9376fdf582e7030eb6fcfec6f123e74a61e
SSDEEP

6144:hnEaQC3iA8y0L85JIqXYhHsntwoOaNNCGwDj6VkAB:maQI49gYQtwoHNCGwSVkAB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa5cd9f1f53351a7121dcfd605bafc54_JaffaCakes118

Files

fa5cd9f1f53351a7121dcfd605bafc54_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a557734e4e71add78760c5e21ec3fc68

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
FindResourceA
WaitForSingleObject
GetModuleFileNameA
GetVersionExA
Sleep
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
GetCurrentProcess
FreeLibrary
GetLastError
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetProcessHeap
HeapCreate
ExitProcess
TlsAlloc
GetStartupInfoA
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
CreateMutexA
GetProcAddress

advapi32

OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
ChangeServiceConfigA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DeleteService

dhcpsapi

DhcpAddServer
DhcpCreateClientInfo
DhcpAddSubnetElement
DhcpEnumClasses
DhcpServerRestoreDatabase
DhcpAddMScopeElement
DhcpEnumServers
DhcpEnumSubnetClientsV4
DhcpServerQueryDnsRegCredentials
DhcpCreateOption
DhcpSetOptionInfo
DhcpGetMibInfo
DhcpServerSetConfig
DhcpGetThreadOptions

msrating

ClickedOnRAT

Sections

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.h
Size: 5KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 93KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.FbIJK
Size: 5KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 126KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.W
Size: 512B - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a557734e4e71add78760c5e21ec3fc68

Headers

File Characteristics

Imports

kernel32

advapi32

dhcpsapi

msrating

Sections

.edata Size: 5KB - Virtual size: 5KB

.h Size: 5KB - Virtual size: 22KB

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 7KB

.edata Size: 93KB - Virtual size: 118KB

.FbIJK Size: 5KB - Virtual size: 391KB

.data Size: 6KB - Virtual size: 66KB

.edata Size: 126KB - Virtual size: 216KB

.W Size: 512B - Virtual size: 49KB

.rsrc Size: 2KB - Virtual size: 1KB

.edata
Size: 5KB - Virtual size: 5KB

.h
Size: 5KB - Virtual size: 22KB

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 7KB

.edata
Size: 93KB - Virtual size: 118KB

.FbIJK
Size: 5KB - Virtual size: 391KB

.data
Size: 6KB - Virtual size: 66KB

.edata
Size: 126KB - Virtual size: 216KB

.W
Size: 512B - Virtual size: 49KB

.rsrc
Size: 2KB - Virtual size: 1KB